I am hosting quite a lot of virtual hosts using Apache in a basic LAMP set up with the help of Webmin/Virtualmin. I am looking for a top-like tool in which I can monitor current connections. The virtual hosting part seems to be giving me trouble here. Here's what I've tried:

netstat - I can see the connections, but they show me as if they're all using my primary domain, e.g. mydomain.com:www.

iftop - I like it a lot, but similar downside as netstat: does not show the virtual host.

apachetop - seems to be showing not information for all my virtual hosts. I'm logging to separate custom log files, which I'm suspecting is the cause for why it doesn't work.

ntop, darkstat, MRTG, bwm-ng, IPTraf - not working either.

So, basically, I'm looking for something similar to the current output of netstat, but to include the virtual host the request is for, e.g.: avirtualsite.com:www.

I am using Apache2 - Default LAMP installation to use with VirtualMin/ Webmin - I just found apachetop - but that only monitors the file i provide.. damnit- not all the servers...
–
ppumkinJan 10 '13 at 17:29

interesting- but if i have 100 virtual websites - will it show me stats for ALL the websites? because the coonection log in /var/log/apache2/access.log is empty because we do not use the default website, each website has its own /log/access.log spread across
–
ppumkinJan 10 '13 at 18:29

1

I like you very much now. Gimme a kiss :* +1
–
ppumkinJan 10 '13 at 18:35

Genius- That is what i needed. it is showing me vhost now! Thanks a million man! I do not know how to repay for your knowledge!
–
ppumkinJan 10 '13 at 18:51

Seriously! I love this status tool sooo much! I have detected so many scripts thanks to this. It helped me to get the sites patched, upgraded and fixed up. Your help is soo appreciated I wish I could give you all my rep!
–
ppumkinJan 16 '13 at 16:15

@ppumkin Don't exaggerate please. It's a very basic and common Apache module for these tasks. Any self-respecting book about Apache will mention it. I'm glad I was helpful in this, though.
–
gertvdijkJan 16 '13 at 16:21

All the tools you are trying will never give you the right answer. The reason is that the information you are requesting is lost when the connection is made.

Let's use an example: suppose your web server has one IP address (1.2.3.4) and two host names (a.mydomain.com and b.mydomain.com) that resolve to that IP address.

What happens when you use your favorite web browser when you visit a.mydomain.com?

The browser (or the kernel, but this distinction is superfluous in this example) asks your DNS server the IP address a.mydomain.com corresponds to.

The DNS server tells the browser the address is 1.2.3.4.

The web browser connects to 1.2.3.4.

So netstat & co. only know that there's an incoming connection made to 1.2.3.4. The reason why you see a host name instead of an IP address is that the IP address has a rDNS record, so netstat prefers to show that instead of the IP, because it's nicer. Try netstat -n (or remove the rDNS record) and you'll see the IP address.

But that's not all: when I said that the information about the host name that was used to make the connection was lost, I wasn't fully right. From the point of view of the TCP/IP stack, that sentence is true. But if we see the things from the point of view of the HTTP protocol, things are different. In every HTTP request there's a Host: header that contains the host name that was used by the browser to make the request.

So, in short, you should look at the log files of your web server. The web server is the service that handles the HTTP requests and therefore the only service that knows about the "original" host name.